Allied Telesis AR Router Configuration page 36

Helpful Scripts
#
# IPSec
ena ipsec
create ips sas=1 prot=esp hasha=null encalg=des keym=isakmp
create ips sas=2 prot=ah mode=tunn hasha=sha keym=isakmp
create ips bundle=1 keym=isakmp string="1 and 2"
create ips pol=isakmp int=ppp10 act=permit lpo=500 rpo=500
create ips pol=tunnel int=ppp10 act=ipsec key=isakmp bund=1 peer=192.168.5.2
set ips pol=tunnel lad=192.168.10.0 lmask=255.255.255.0 rad=192.168.20.0 rmask=255.255.255.0
#
#ISAKMP
# Note: Use Section 1.5 to enable system security and generate an Encryption Key of type GENERAL
# on router A and B
# This example uses the same network key for all ISAKMP Exchanges
cre isa pol=keys peer=192.168.5.2 hashalg=sha key=1
set isa pol=keys senddeletes=on setcommitbit=on sendnotify=on
enable isakmp
Router B
set user securedelay=600
add user=secoff pass=<your password> priv=sec
#
# L2TP Configuration
enable l2tp
enable l2tp server=both
set l2tp password="secret"
add l2tp call="tunnel" rem="tunnel" ip=200.200.200.1 ty=virtual prec=in
set l2tp call="tunnel" pass=secret
#
# ppp configuration
# Note: Tunnel is PPP10
create ppp=0 over=syn0
create ppp=10 over=tnl-tunnel idle=999999999
#
# IP
#
enable ip
Add ip int=eth0 ip=192.168.20.1 mask=255.255.255.0
Add ip int=ppp0 ip=222.222.222.1
add ip int=ppp10 ip=192.168.5.2
add ip rou=0.0.0.0 next=0.0.0.0 int=ppp0
add ip rou=192.168.10.0 next=0.0.0.0 int=ppp10
#
# Firewall
# To enable out going ping see example 5.1.1
enable firewall
create firewall policy="main"
add firewall policy="main" int=eth0 type=private
add firewall policy="main" int=ppp10 type=private
add firewall policy="main" int=ppp0 type=public
add firewall poli="main" nat=enhanced int=eth0 gblin=ppp0 gblip=222.222.222.1
add fire poli=main ru=1 int=ppp0 action=allow ip=222.222.222.1 proto=udp po=1701
set fire poli=main ru=1 gblip=222.222.222.1 gblp=1701 rem=200.200.200.1
#
# IPSec
#
ena ipsec
create ips sas=1 prot=esp hasha=null encalg=des keym=isakmp
create ips sas=2 prot=ah mode=tunn hasha=sha keym=isakmp
create ips bundle=1 keym=isakmp string="1 and 2"
create ips pol=isakmp int=ppp10 act=permit lpo=500 rpo=500
create ips pol=tunnel int=ppp10 act=ipsec key=isakmp bund=1 peer=192.168.5.1
set ips pol=tunnel lad=192.168.20.0 lmask=255.255.255.0 rad=192.168.10.0 rmask=255.255.255.0
#
#ISAKMP
# Note: Use Section 1.5 to enable system security and generate an Encryption Key of type GENERAL
# on router A and B
# This example uses the same network key for all ISAKMP Exchanges
cre isa pol=keys peer=192.168.5.1 hashalg=sha key=1
set isa pol=keys senddeletes=on setcommitbit=on sendnotify=on
enable isakmp
Helpful Scripts
Revision 5.8.7; 5 April 2001
Page
36